Weaknesses of type CWE-732

791 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-41118CRITICALSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionEPSS 0.4%CVE-2024-54910MEDIUMHasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.EPSS 0.4%CVE-2026-26929MEDIUMApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataEPSS 0.4%CVE-2026-77256HIGHMCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umaskEPSS 0.4%CVE-2024-57068HIGHA prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS)EPSS 0.4%CVE-2020-1736LOWA flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destEPSS 0.4%CVE-2023-1939MEDIUMNo access control for the OTP key on OTP entriesEPSS 0.4%CVE-2024-29078HIGHIncorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unautheEPSS 0.4%CVE-2020-15708CRITICALLibvirt Service Arbitrary File Write Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-40804CRITICALA vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a netwoEPSS 0.4%CVE-2025-69426CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCEEPSS 0.4%CVE-2021-24703—Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin ActivationEPSS 0.4%CVE-2022-1316HIGHIncorrect Permission Assignment for Critical Resource in zerotier/zerotieroneEPSS 0.4%CVE-2025-14988CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDAEPSS 0.4%CVE-2024-11176MEDIUMIncorrect evaluation of effective permissions in M-Files AinoEPSS 0.4%CVE-2026-20693MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26EPSS 0.4%CVE-2026-62195HIGHOpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopbackEPSS 0.4%CVE-2024-55411HIGHAn issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via suEPSS 0.4%CVE-2023-32162HIGHWacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-45471HIGHInsecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.EPSS 0.4%